public/qemu
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

hw/xen: prevent guest from binding loopback event channel to itself

Browse source 
Fuzzing showed that a guest could bind an interdomain port to itself, by
guessing the next port to be allocated and putting that as the 'remote'
port number. By chance, that works because the newly-allocated port has
type EVTCHNSTAT_unbound. It shouldn't.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Paul Durrant <paul@xen.org>
Message-Id: <20230801175747.145906-4-dwmw2@infradead.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
This commit is contained in:
David Woodhouse 2023-07-25 12:05:00 +02:00 committed by Philippe Mathieu-Daudé
parent 19c417ec87
commit 75a87af9b2
1 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
hw/i386/kvm/xen_evtchn.c
View file

@ -1408,8 +1408,15 @@ int xen_evtchn_bind_interdomain_op(struct evtchn_bind_interdomain *interdomain)
XenEvtchnPort *rp = &s->port_table[interdomain->remote_port];
XenEvtchnPort *lp = &s->port_table[interdomain->local_port];
if (rp->type == EVTCHNSTAT_unbound && rp->type_val == 0) {
/* It's a match! */
/*
* The 'remote' port for loopback must be an unbound port allocated for
* communication with the local domain (as indicated by rp->type_val
* being zero, not PORT_INFO_TYPEVAL_REMOTE_QEMU), and must *not* be
* the port that was just allocated for the local end.
*/
if (interdomain->local_port != interdomain->remote_port &&
rp->type == EVTCHNSTAT_unbound && rp->type_val == 0) {
rp->type = EVTCHNSTAT_interdomain;
rp->type_val = interdomain->local_port;